It is possible to set On Login and On Logout scripts in hotspot user profile. I think the On Error script would be also very usefull.

Use cases:

• log authentication errors
• ban users
• send emails to admin

All above could be done like in this example: https://wiki.mikrotik.com/wiki/Log_Pars ... ger_Script, but in my opinion On Error is more efficient way.

Not directly an answer to your request, but you can graph the log (hotspot log and other) using a third party syslogger like Splunk.
Se link in my signature for how to use Splunk with MikroTik. There is an hotspot user view.

Direct link to the hotspot view
viewtopic.php?f=23&t=137338#p680632

Thank you for answer. I found article about splunk couple of days ago, but those are two different things. My sugestion is mainly about taking an action on the router after error. Sure, we can write even simple PHP script which connects to the router every "minute" and checks the logs in order to ban users or have hotspot login page on external machine to do additional checking or use any third party software (splunk) with some "handlers", but the "On Error" script would be more efficient and cleaner way.